How to Get a Free SSL Certificate on Ubuntu with Lets Encrypt and Certbot Print

HTTPS stopped being optional years ago: browsers flag plain HTTP as “Not secure”, Google uses it as a ranking signal, and no visitor should type a password on an unencrypted page. Thanks to Let's Encrypt, TLS certificates are free, and Certbot automates issuing, installing and renewing them on Ubuntu 24.04. Total time: about five minutes.

Prerequisites

A running web server — Nginx or Apache — with a server block/virtual host for your domain, DNS A/AAAA records pointing at the server, and ports 80 and 443 open in UFW.

Step 1 — Install Certbot

For Nginx:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

For Apache, install python3-certbot-apache instead.

Step 2 — Request and install the certificate

sudo certbot --nginx -d example.com -d www.example.com

Certbot proves you control the domain, obtains the certificate, rewrites your server block for TLS and sets up the HTTP→HTTPS redirect when you ask it to.

(Apache users: sudo certbot --apache -d example.com -d www.example.com.)

Step 3 — Verify automatic renewal

Let's Encrypt certificates last 90 days by design — renewal must be automatic. The Ubuntu package installs a systemd timer that checks twice a day; confirm it works:

sudo certbot renew --dry-run

If the dry run succeeds you are done: renewals will happen unattended, and Certbot reloads the web server after each one.

Wildcard certificates

Need *.example.com? Wildcards require DNS-01 validation — Certbot must create a TXT record, so you need a DNS plugin for your provider (Cloudflare, Route53 and many others are supported):

sudo apt install python3-certbot-dns-cloudflare -y
sudo certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
  -d "example.com" -d "*.example.com"

Troubleshooting

“Challenge failed” / connection refused: port 80 must be reachable from the internet during validation — check sudo ufw status and any cloud provider firewall. “DNS problem: NXDOMAIN”: your A record has not propagated yet; test with dig +short example.com. Rate limits: Let's Encrypt allows 5 duplicate certificates per week — use --dry-run while testing, not real issuance.

Grade your setup

After installation, run your domain through SSL Labs' server test. The Certbot defaults on Ubuntu 24.04 score an A; adding HTTP/2 and HSTS in your server block gets you to A+.

Related Ubuntu guides

• How to Install a LEMP Stack (Nginx, MySQL, PHP) on Ubuntu 24.04
• How to Install a LAMP Stack (Apache, MySQL, PHP) on Ubuntu 24.04
• How to Set Up UFW Firewall on Ubuntu 24.04: Complete Configuration Guide
• How to Update Ubuntu Server: apt, Security Patches and Unattended Upgrades